Entries from system static-host-mapping reach pdns-recursor through /etc/hosts and export-etc-hosts. PowerDNS turns each hostname into an authoritative zone. As a result, every name below a mapped host gets NXDOMAIN with a synthetic SOA (localhost. root.).

authoritative-domain is also implemented as an auth-zone, so it has the same limitation. PowerDNS Recursor also does not follow out-of-zone CNAMEs or NS delegations from auth-zones, so clients get only the CNAME or the delegation.

This is important for a split DNS use case:
subdomain.example.com must resolve to an internal IP for VPN clients, while public DNS points to a Public IP address. Because the static mapping shadows its subdomains, _acme-challenge.subdomain.example.com (TXT) cannot be resolved through VyOS, and ACME DNS-01 pre-checks fail for internal clients.

Steps to reproduce

set system static-host-mapping host-name subdomain.example.com inet 10.0.0.10
set service dns forwarding allow-from 10.0.0.0/8
set service dns forwarding listen-address 10.0.0.1
commit;save;exit
dig @10.0.0.1 _acme-challenge.subdomain.example.com TXT

Expected: the public TXT record is returned.
Actual: NXDOMAIN, with SOA localhost. root.

• I'd request to add a transparent per-name override, for example, set service dns forwarding override <fqdn> a|aaaa <address>.
• It would answer only the exact name and type, and all other names and types would resolve normally.